Thoughts on safe autonomy, engineering automation, and reducing cognitive overhead without putting your systems at risk.
An open-source AI pentest platform that now promises "governed execution" turned up on infrastructure tied to more than 600 compromised FortiGate devices. The governing is done by whoever runs it, and that's true of your agents too.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
A fake-font credential stealer landed in 12,137 GitHub repos between October 14 and 16, about 130 times the cluster in the only write-up so far. It goes straight for Claude Code, Gemini and OpenAI credentials. We found malware in nine forks of REA.
Between October 1 and 8, a proposed Senate bill, the Wikimedia Foundation and the UK's data regulator all put AI agent operators on notice. Whoever runs an agent answers for what it does to everyone else.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
Agent control is turning into a product you can buy. Open or closed, you didn't write it, so what it does in your environment is the only proof you'll get.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
Darktrace rewrote the saved conversations of four coding agents and got them to attack a network. The lesson isn't about signatures. It's about where your agent's permission comes from.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
Seven defects surfaced in one migration. None of them crashed, none failed a test, and none turned a dashboard red. A broken control and a working control send the same signal: silence.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
An agent refused to run the attacker's binary, then wrote its own decoder and ran the payload anyway. Three incidents and one of our own show the same thing: a constraint you hand an agent is a preference it can route around.
